On: Passive SSH Key Compromise via Lattices [pdf]

[magicalhippo]

I read it as "only" the signing machine needs faulty hardware. Still, bit errors occur, even with ECC, and this allows for a passive hence very unobtrusive attack.